CN116614489A - Cloud data acquisition method and device, electronic equipment and storage medium - Google Patents

Abstract

The application provides a cloud data acquisition method, a device, electronic equipment and a storage medium, wherein the cloud data acquisition method comprises the following steps: acquiring network data from a non-application layer of a system running a target APP; searching links of cloud data corresponding to the target APP in the network data, wherein the cloud data corresponding to the links are decrypted data; and acquiring decrypted cloud data based on the link. Because the cloud data corresponding to the link are in a decryption state, the acquired cloud data are not encrypted, compared with the password input during link access acquired through an application layer, the password input during link access acquired through a non-application layer is not needed, further the source code of the APP is not needed to be manually re-analyzed to acquire decryption data, and the acquisition efficiency of the APP cloud data can be improved.

Description

Cloud data acquisition method and device, electronic equipment and storage medium

Technical Field

The present application relates to the field of network security technologies, and in particular, to a method and apparatus for acquiring cloud data, an electronic device, and a storage medium.

Background

At present, an audio and video file is fixed from an APP cloud end, and the main mode is as follows: first, a Fiddler bale tool is run in a simulator. Then, the APP is run in a simulator. As long as APP is involved in audio-video during operation, for example: music and the like are played, and the Fiddler packet capturing tool can acquire audio and video files from the APP cloud through an application layer of the simulator. In order to prevent the audio and video files from being acquired, the APP sets passwords for the audio and video files, and the audio and video files acquired by the Fiddler packet capturing tool are encrypted. In order to obtain an audio-video file that can be played, the obtained audio-video file needs to be decrypted. Because the encryption passwords of different APP's to its audio and video files are different, therefore need the manual work to analyze the program source code of every APP alone, obtain the encryption password, and then decrypt the audio and video file that obtains. However, the audio and video files acquired from the APP cloud end are decrypted only by manpower, so that the decryption efficiency is quite low, and the fixing efficiency of the APP cloud end audio and video files is low.

Disclosure of Invention

The embodiment of the application aims to provide a cloud data acquisition method, a cloud data acquisition device, electronic equipment and a storage medium, which do not need to decrypt acquired cloud data and improve the fixing efficiency of APP cloud data.

In order to solve the technical problems, the embodiment of the application provides the following technical scheme:

the first aspect of the present application provides a cloud data acquisition method, which includes: acquiring network data from a non-application layer of a system running a target APP; searching links of cloud data corresponding to the target APP in the network data, wherein the cloud data corresponding to the links are decrypted data; and acquiring decrypted cloud data based on the link.

The second aspect of the present application provides a cloud data acquisition device, which includes: the first acquisition module is used for acquiring network data from a non-application layer of a system running the target APP; the searching module is used for searching links of cloud data corresponding to the target APP in the network data; and the second acquisition module is used for acquiring the decrypted cloud data based on the link.

A third aspect of the present application provides an electronic apparatus, comprising: a processor, a memory, a bus; the processor and the memory complete communication with each other through the bus; the processor is configured to invoke program instructions in the memory to perform the method of the first aspect.

A fourth aspect of the present application provides a computer-readable storage medium, the storage medium comprising: a stored program; wherein the program, when run, controls a device in which the storage medium is located to perform the method in the first aspect.

Compared with the prior art, the cloud data acquisition method provided by the first aspect of the application acquires network data through the non-application layer of the target APP operation system, then acquires the link of the target APP cloud data from the network data, and further acquires the APP cloud data through the link, and the acquired cloud data are not encrypted because the cloud data corresponding to the link are in a decryption state.

The cloud data acquisition device provided in the second aspect of the present application, the electronic device provided in the third aspect of the present application, and the computer readable storage medium provided in the fourth aspect of the present application have the same or similar beneficial effects as the cloud data acquisition method provided in the first aspect.

Drawings

The above, as well as additional purposes, features, and advantages of exemplary embodiments of the present application will become readily apparent from the following detailed description when read in conjunction with the accompanying drawings. In the drawings, wherein like or corresponding reference numerals indicate like or corresponding parts, there are shown by way of illustration, and not limitation, several embodiments of the application, in which:

fig. 1 is a schematic diagram of an architecture for acquiring APP cloud data in the prior art;

fig. 2 is a schematic diagram of an architecture for acquiring APP cloud data in an embodiment of the present application;

fig. 3 is a flow chart of a method for acquiring cloud end data in an embodiment of the present application;

fig. 4 is a schematic flow chart of acquiring an APP cloud audio/video file in the embodiment of the present application;

fig. 5 is a schematic structural diagram of a cloud end data acquiring device according to an embodiment of the present application;

fig. 6 is a schematic structural diagram of an electronic device according to an embodiment of the application.

Detailed Description

Exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present application are shown in the drawings, it should be understood that the present application may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the application to those skilled in the art.

It is noted that unless otherwise indicated, technical or scientific terms used herein should be given the ordinary meaning as understood by one of ordinary skill in the art to which this application belongs.

At present, cloud data of an APP are obtained, the data sent by a cloud server received in an application layer of a system where the APP is located are mainly grabbed through a Fiddler grabbing tool, and then the data are decrypted through a decryption password obtained by manually analyzing an APP source code, so that the cloud data of the APP are obtained. However, the number of the APP is large, the source codes of the APP are analyzed one by one and the acquired data are decrypted, so that the efficiency is obviously low, and the acquisition efficiency of the APP cloud data is low.

Fig. 1 is a schematic diagram of an architecture for acquiring APP cloud data in the prior art, referring to fig. 1, a system where an APP client is located needs to acquire APP cloud data, and the system first sends a request to the cloud, where the request is encapsulated by architecture layers (needs to be determined according to a specific architecture of the system) such as an application layer, a presentation layer, a session layer, a transmission layer, a network layer, a data link layer, and a physical layer of the system, and then sends the request to the cloud. The cloud receives the request, analyzes the request through architecture layers (which need to be determined according to a specific architecture of the cloud) such as a physical layer, a data link layer, a network layer, a transmission layer, a session layer, a presentation layer, an application layer and the like of the cloud, returns a response to the system based on the request, and sends the response to the cloud through the application layer to the physical layer of the cloud. The cloud obtains a response from the physical layer to the application layer, so that cloud data is obtained through the response. The Fiddler packet capturing tool captures a response from an application layer of the system, and then decrypts the password obtained by APP source code analysis manually, so that APP cloud data are obtained.

The inventor finds that if cloud data is not captured from an application layer, but captured from other layers except the application layer in a system architecture layer, the data in the other layers is richer and deeper than the data in the application layer, decrypted data can exist, so that password-free data can be obtained, the decryption process is skipped, and the APP cloud data obtaining efficiency is improved.

In view of this, the embodiment of the application provides a method, a device, an electronic device and a storage medium for acquiring cloud data, which acquire data from a non-application layer of an APP operating system, and then acquire links of the cloud data from the data, so that the cloud data of the APP is acquired through the links, the acquired cloud data is decrypted data, the source code acquisition password of the APP is not required to be manually re-analyzed to decrypt, and the method, the device, the storage medium and the storage medium can be executed according to each APP needing to acquire the cloud data, thereby improving the acquisition efficiency of the APP cloud data.

Fig. 2 is a schematic diagram of an architecture for acquiring APP cloud data in an embodiment of the present application, and referring to fig. 2, the process of sending a request, receiving a request, returning a response, and receiving a response between the system where the APP client is located and the APP cloud in fig. 1 is the same, that is, when the response is captured, the response is not captured from an application layer of the system but captured from a non-application layer, and at this time, the captured data corresponding to the response is in a decryption state. The APP cloud data can be directly obtained without encryption.

Next, a detailed description will be given of a method for acquiring cloud data provided by the embodiment of the present application.

Fig. 3 is a flow chart of a method for acquiring cloud end data in an embodiment of the present application, and referring to fig. 3, the method may include:

s301: network data is obtained from a non-application layer of a system running the target APP.

The target APP here is the APP that needs to acquire its cloud data. In actual practice, the target APP may be one or more illicit/offending APPs to be forensic. The specific type of target APP is not limited herein.

The APP is to be used by a user, a client of the APP is to be installed in equipment of the user, the equipment can run the APP and is supported by an operating system, and the operating system is a system for running the target APP. The system is structured, namely, a plurality of layers exist, wherein an application layer is in butt joint with an APP client, other layers except the application layer in the structure layer can be non-application layers, network data are obtained from the non-application layers, the network data received from a cloud are mainly obtained, and the data obtained through the network data are all in a decryption state.

Any tool that can capture data from the non-application layer may be used in the process of obtaining the network data from the non-application layer, and the specific type of the tool is not limited herein.

S302: searching links of cloud data corresponding to the target APP in the network data, wherein the cloud data corresponding to the links are decrypted data.

After the network data is acquired from the non-application layer, the cloud data to be acquired is not the network data, the cloud data is stored at a certain position of the cloud, and the network data comprises a storage position of the cloud data, namely a link, so that the cloud data in a decryption state can be found through the link acquired from the network data.

In the process of searching links in the network data, the links of the cloud data requested by the target APP can be automatically identified according to the characteristics or the identifiers of the links and the target APP, and then the links are opened to obtain the cloud data, or each piece of sub-data in the network data can be opened as a link, if the sub-data can be opened, the sub-data is considered as the links, the cloud data of the APP is obtained, and if the sub-data cannot be opened, the sub-data is considered as the links. The specific manner in which links are found from network data is not limited herein.

S303: and acquiring decrypted cloud data based on the link.

After searching the link of the APP cloud data, opening the link is equivalent to the fact that the APP client is ready, and the data can be opened, at the moment, the cloud data are in a decryption state, and therefore the acquired cloud data are not encrypted.

In the process of acquiring cloud data based on the link, the corresponding page can be opened by using the link, the cloud data is displayed in the page, and the cloud data can be stored locally through the modes of screen capturing, recording, downloading and the like.

As can be seen from the foregoing, in the cloud data acquisition method provided by the embodiment of the present application, network data is acquired through a non-application layer of a target APP operating system, then a link of the target APP cloud data is acquired from the network data, and further the cloud data of the APP is acquired through the link, and because the cloud data corresponding to the link are all in a decryption state, the acquired cloud data are not encrypted, and compared with the password input when the link access acquired through the application layer is required, the password input when the link access acquired through the non-application layer is required, and further the decrypted data acquired through manually re-analyzing the source code of the APP is not required, so that the acquisition efficiency of the cloud data can be improved.

Further, a plurality of layers are arranged outside the application layer in the system architecture layer, and the network data is acquired from the layers according to the sequence, so that the network data needs to be preset.

Specifically, the step S301 may include:

step A1: at least one target layer is determined from among the non-application layers.

In the architecture layer of the system, there are several other layers, i.e. non-application layers, in addition to the application layer. In the non-application layer, one or more layers for extracting network data, i.e., target layers, need to be determined first.

Step A2: the query order of the at least one target tier is determined based on an inverse of the hierarchical order in which the system processes the received data.

The hierarchical order in which the system processes the received data refers to the order in which layers process the data first, layers process the data again, and layers process the data last after the system receives the data sent by the cloud. Generally, after receiving data, the system processes the data first by the physical layer, processes the data again by the data link layer, the network layer, the transport layer, the session layer, the presentation layer, and the like, and processes the data last by the application layer. The determined target layers are ordered in the reverse order of the order described above.

For example, assume that the hierarchical order in which the system processes the received data is a-layer, b-layer, c-layer, d-layer, e-layer, the determined target layers are b-layer and c-layer. Then the query sequence is c-layer followed by b-layer.

It should be noted that, when the number of the determined target layers is 1, the sequence is not reordered in step A2, and the process proceeds directly to step A3.

Step A3: and judging whether the data of each target layer contains links layer by layer according to the query sequence. If so, executing the step A4, and if not, executing the step A5.

When the number of the determined target layers is 1, whether the layers contain links or not is directly judged. When the determined target layers are 2 or more than 2, judging whether the data of the 1 st layer contains links according to the query sequence, if so (judging that one link is needed), taking the data of the layer as network data, if not, continuously judging whether the data of the 2 nd layer contains links, if not, directly outputting prompt information to prompt that the target APP cloud-free end data can be obtained until the data of the last 1 layer in the query sequence does not contain links.

Step A4: the data of the corresponding layer is taken as network data.

That is, the data in the layer where the existence of the link is judged for the first time is taken as the network data. For example: the target layer is a layer c and a layer b, whether the link exists in the data of the layer c is judged firstly, if the link exists, the data of the layer c is used as network data, if the link does not exist, whether the link exists in the data of the layer b is continuously judged, and if the link exists, the data of the layer b is used as network data.

Step A5: and outputting prompt information which can be obtained by the cloud-end-free data.

When links do not exist in the data of all the target layers, the fact that unencrypted cloud data cannot be obtained through the links is indicated, and prompt information can be sent to a user at the moment to prompt the user that current cloud-end-free data can be obtained. If the target layer is not all layers except the application layer in the architecture layer, the user can add the layers which are not in the target layer from all layers except the application layer, and the judgment can be continued.

From the above, it can be seen that, according to the reverse order of the hierarchical order of the system processing received data, the determined target layer is judged layer by layer whether there is a link in the data, and the data of the layer where the link is determined for the first time is used as the network data.

Further, when determining the target layer from the non-application layer, the target layer is not determined randomly, and needs to be determined according to a preset rule, or the target layer can be specified by the user in the current extraction process.

Specifically, the step A1 may include:

step A11: and judging whether a configuration instruction for setting the target layer exists. If so, step A12 is performed, and if not, step A13 is performed.

Because the hierarchical architecture of the systems in which the APP operates is not exactly the same, some of the systems have some layers, some of the systems do not have some layers, or the same function is provided in different layers for different systems. Therefore, by setting the configuration instruction of the target layer, in the process of acquiring the cloud data of the target APP, the network data can be determined from which layers are required to be extracted according to the actual architecture level of the system operated by the target APP.

Step A12: and determining a target layer according to the configuration instruction.

When a configuration instruction is present, a target layer is determined from the architecture layers of the system in accordance with the configuration instruction.

Step A13: and determining a target layer according to the preset configuration information.

And when no configuration instruction exists, determining the target layer according to default preset configuration information. That is, if the user does not specify the target layer in the current cloud data acquisition process, the target layer is determined according to default preset configuration information. The preset configuration information may be all layers except the application layer or one or more designated layers in the system architecture layer, and may also be a network layer or a transport layer.

According to the method, whether the configuration instruction exists or not is judged, when the configuration instruction exists, the target layer is determined according to the configuration instruction, the flexibility of determining the target layer can be improved, and therefore cloud data of the target APP can be obtained in each cloud data obtaining process.

Further, only one APP may not be operated in the system, and there may be multiple APPs operating simultaneously, that is, the system may receive data of multiple APPs at the same time, so that data of a target APP needs to be screened from the data of multiple APPs, and then linked extraction is performed.

Specifically, the step S301 may include:

step B1: and acquiring data received by each APP from a non-application layer of a system running the target APP.

And no matter how many APPs are currently operated in the system, all data in the non-application layer are acquired firstly, and then the data received by the system are extracted from the data, so that the data received by all APPs in the non-application layer are obtained.

Step B2: and screening the data received by the target APP from the data received by each APP, and taking the data as network data.

In the process of screening the data received by the target APP from the data received by each APP, the data with the target APP identifier can be extracted completely, or the data corresponding to the information pointing to the target APP port can be extracted to serve as the data received by the target APP, and further serve as the network data. The specific manner in which the data received by the target APP is selected from the data received by the respective APPs is not limited herein.

From the above, it can be seen that the data received by the target APP is selected from the data received by each APP of the non-application layer and used as the network data, so that the link extraction from the data received by the non-target APP can be avoided, the workload of link extraction is reduced, and the cloud data acquisition efficiency is improved.

Further, when multiple APPs are running simultaneously in the system, the data received by each APP can be considered as a packet, and the collection of packets is the network data. If the acquired cloud data are audio and video files, the data packets can be screened according to the audio and video characteristics, and the data packets without the audio and video characteristics are eliminated, namely, the data received by the APP without the audio and video are eliminated, so that the efficiency of extracting links from the data is improved, and the acquisition efficiency of the audio and video files is further improved.

Specifically, the step S302 may include:

step C1: and searching a target data packet with audio and video characteristics in the plurality of data packets.

Because the target APP is the APP related to the audio and video, and the APP cloud data to be acquired is the audio and video file, the data packet corresponding to the target APP in the non-application layer of the visible system necessarily has the audio and video characteristics, therefore, the audio and video characteristics of each data packet in the non-application layer are judged, and the data packet with the audio and video characteristics is judged to be the target data packet.

In practical applications, the audio-video features may be in some preset data format, for example: MP4, FLV, etc. The audio and video feature may also be a condition that the data size is larger than the preset data size, because the audio and video file is generally a larger file, if the data size of the data packet is larger than the preset data size, it is indicated that the data packet is larger, and the APP corresponding to the data packet may be the audio and video APP.

Step C2: and searching links of the audio and video files corresponding to the target APP from the target data packet.

Although the target APP is an audio-video APP, the audio-video APP except the target APP can be operated in the system at the same time. After determining the target data packets, if the number of the target data packets is 1, indicating that the data packets are the target APP, the links can be directly obtained from the target data packets, and if the number of the target data packets is multiple, deleting the data packets without the identification in the target data packets according to the identification of the APP, and then obtaining the links from the deleted target data packets.

After the target data packet is determined, all links contained in the target data packet can be searched, and links of the audio and video files are screened out from all links based on the audio and video format, so that the links of the audio and video files corresponding to the target APP are further used as links of the audio and video files.

According to the method, the target data packet is determined from the plurality of data packets of the non-application layer through the audio and video characteristics, and then links of audio and video files corresponding to the target APP are searched based on the target data packet, useless links are prevented from being searched from other non-video APPs, searching efficiency of the links is improved, and further obtaining efficiency of APP cloud data is improved.

Further, after the link is obtained, the cloud data corresponding to the link is in a decryption state, and can be directly checked, and the cloud data is obtained in a corresponding mode.

Specifically, the step S303 may include:

step D1: the link is opened by the computer browser.

Generally, links may be opened through a computer browser. Specifically, the links are input into an address bar of the computer browser, so that the computer browser accesses cloud data of the target APP through the links, and the cloud data of the target APP is displayed through the computer browser.

Of course, in addition to opening a link through a computer browser, the link may also be opened through a browser in the cell phone. The specific carrier of the browser is not limited herein.

Step D2: and searching cloud data in the opened link.

After the computer browser accesses the address corresponding to the link, the content corresponding to the link is displayed in the computer browser. In the displayed content, some content may not be the cloud data that needs to be acquired this time, so the cloud data that needs to be acquired this time needs to be searched in the displayed content.

In a specific searching process, the cloud data which needs to be acquired at this time can be found out from the content displayed by the browser according to the result of manual selection by manually selecting the cloud data from the display page of the browser. The cloud data which needs to be acquired at this time can also be directly found in the content displayed by the browser according to a preset selection rule. The specific manner of searching the cloud data to be acquired in the browser display page is not limited herein.

Step D3: and downloading the searched cloud data to the local.

After the required cloud data is found in the display page of the browser, if the display page of the browser has a downloading function, the required cloud data can be directly downloaded to the local through the downloading function provided in the display page of the browser, and if the display page of the browser does not have the downloading function, the required cloud data can be downloaded to the local through the modes such as screenshot or screen recording. The specific manner of storing the cloud data is not limited herein.

According to the content, the link is opened through the computer browser, and the opened content is downloaded to the local, so that the cloud data of the target APP can be stored for a long time.

Finally, a specific example is used for explaining the cloud data acquisition method provided by the embodiment of the application again.

Fig. 4 is a schematic flow chart of acquiring an APP cloud audio/video file in the embodiment of the present application, and referring to fig. 4, first, a Fiddler packet capturing tool is configured and operated. Then, a music player is operated in the lightning simulation, and a piece of music is selected to play, and the playing is paused for a few seconds. Next, a port forwarding policy (who will send the captured data) and an application filtering policy (data of the target APP is selected from the captured data) of the drop capture tool are configured and run. The network data of the network layer or the transmission layer of the simulated mobile phone system is then forwarded to the Fiddler packet-grabbing tool by the Drony packet-grabbing tool based on the VPN. The network data packet is analyzed through the Fiddler packet grasping tool, the link of the audio file is found, then the link is opened by using the computer browser, the music playing file is obtained by selecting to download or save the music playing file to the local, and the music playing file can be directly opened and played by using the multimedia player. Finally, the APP cloud audio and video file is obtained without secret, and the fixing efficiency of the APP cloud audio and video file is improved.

Based on the same inventive concept, as an implementation of the method, the embodiment of the application further provides a cloud data acquisition device. Fig. 5 is a schematic structural diagram of an apparatus for acquiring cloud end data according to an embodiment of the present application, and referring to fig. 5, the apparatus may include:

a first obtaining module 501, configured to obtain network data from a non-application layer of a system running a target APP;

the searching module 502 is configured to search the network data for a link of cloud data corresponding to the target APP, where the cloud data corresponding to the link is decrypted data;

and a second obtaining module 503, configured to obtain the decrypted cloud data based on the link.

In other embodiments of the present application, the first obtaining module is specifically configured to determine at least one target layer from the non-application layers; determining a query order of the at least one target layer according to an inverse of a hierarchical order of the system processing received data; judging whether the data of each target layer contains links layer by layer according to the query sequence; if so, the data of the corresponding layer is used as network data; and if the target layers do not contain, outputting prompt information which can be obtained by the cloud end-free data.

In other embodiments of the present application, the first obtaining module is specifically configured to determine whether a configuration instruction for setting the target layer exists; if yes, determining the target layer according to the configuration instruction; if not, determining the target layer according to preset configuration information.

In other embodiments of the present application, the first obtaining module is specifically configured to obtain, from a non-application layer of a system running the target APP, data received by each APP; and screening the data received by the target APP from the data received by each APP, and taking the data as network data.

In other embodiments of the present application, the network data includes a plurality of data packets, each data packet is data received by an APP running in the system, and the cloud data is an audio/video file; the searching module is specifically configured to search the plurality of data packets for a target data packet with an audio/video feature; and searching links of the audio and video files corresponding to the target APP from the target data packet.

In other embodiments of the present application, the second obtaining module is specifically configured to open the link through a computer browser; searching cloud data in the opened link; and downloading the searched cloud data to the local.

In other embodiments of the present application, the first obtaining module is specifically configured to obtain network data from a non-application layer of a system running the target APP by using a drop packet capturing tool; the searching module is specifically configured to search links of cloud data corresponding to the target APP in the network data through a filler packet capturing tool, where the cloud data corresponding to the links are decrypted data.

It should be noted here that the description of the above device embodiments is similar to the description of the method embodiments described above, with similar advantageous effects as the method embodiments. For technical details not disclosed in the embodiments of the apparatus of the present application, please refer to the description of the embodiments of the method of the present application.

Based on the same inventive concept, the embodiment of the application also provides electronic equipment. Fig. 6 is a schematic structural diagram of an electronic device according to an embodiment of the present application, and referring to fig. 6, the electronic device may include: a processor 601, a memory 602, a bus 603; wherein, the processor 601 and the memory 602 complete communication with each other through the bus 603; the processor 601 is operative to invoke program instructions in the memory 602 to perform the methods in one or more embodiments described above.

It should be noted here that the description of the above embodiments of the electronic device is similar to the description of the above embodiments of the method, with similar advantageous effects as the embodiments of the method. For technical details not disclosed in the embodiments of the electronic device of the present application, please refer to the description of the method embodiments of the present application for understanding.

Based on the same inventive concept, embodiments of the present application also provide a computer-readable storage medium, which may include: a stored program; wherein the program, when executed, controls a device in which the storage medium resides to perform the methods of one or more of the embodiments described above.

It should be noted here that the description of the above embodiments of the storage medium is similar to the description of the above embodiments of the method, with similar advantageous effects as the embodiments of the method. For technical details not disclosed in the storage medium embodiments of the present application, please refer to the description of the method embodiments of the present application for understanding.

The foregoing is merely illustrative of the present application, and the present application is not limited thereto, and any person skilled in the art will readily recognize that variations or substitutions are within the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims (10)

1. The method for acquiring cloud data is characterized by comprising the following steps:

acquiring network data from a non-application layer of a system running a target APP;

searching links of cloud data corresponding to the target APP in the network data, wherein the cloud data corresponding to the links are decrypted data;

and acquiring decrypted cloud data based on the link.

2. The method of claim 1, wherein the obtaining network data from a non-application layer of a system running the target APP comprises:

determining at least one target layer from the non-application layers;

determining a query order of the at least one target layer according to an inverse of a hierarchical order of the system processing received data;

judging whether the data of each target layer contains links layer by layer according to the query sequence;

if so, the data of the corresponding layer is used as network data;

and if the target layers do not contain, outputting prompt information which can be obtained by the cloud end-free data.

3. The method of claim 2, wherein said determining at least one target layer from said non-application layers comprises:

judging whether a configuration instruction for setting the target layer exists or not;

if yes, determining the target layer according to the configuration instruction;

if not, determining the target layer according to preset configuration information.

4. The method of claim 1, wherein the obtaining network data from a non-application layer of a system running the target APP comprises:

acquiring data received by each APP from a non-application layer of a system running a target APP;

and screening the data received by the target APP from the data received by each APP, and taking the data as network data.

5. The method of claim 1, wherein the network data comprises a plurality of data packets, each data packet being data received by an APP running in the system, the cloud data being an audio-video file; the searching the link of the cloud data corresponding to the target APP in the network data comprises the following steps:

searching a target data packet with audio and video characteristics in the plurality of data packets;

and searching links of the audio and video files corresponding to the target APP from the target data packet.

6. The method of claim 1, wherein the obtaining decrypted cloud data based on the link comprises:

opening the link through a computer browser;

searching cloud data in the opened link;

and downloading the searched cloud data to the local.

7. The method according to any one of claims 1 to 6, wherein said obtaining network data from a non-application layer of a system running a target APP comprises:

acquiring network data from a non-application layer of a system running a target APP by adopting a Drony packet capturing tool;

the searching the link of the cloud data corresponding to the target APP in the network data comprises the following steps:

searching links of cloud data corresponding to the target APP in the network data through a Fiddler packet capturing tool.

8. A cloud data acquisition device, the device comprising:

the first acquisition module is used for acquiring network data from a non-application layer of a system running the target APP;

the searching module is used for searching links of cloud data corresponding to the target APP in the network data, wherein the cloud data corresponding to the links are decrypted data;

and the second acquisition module is used for acquiring the decrypted cloud data based on the link.

9. An electronic device, the electronic device comprising: a processor, a memory, a bus; the processor and the memory complete communication with each other through the bus; the processor is configured to invoke program instructions in the memory to perform the method of any of claims 1 to 7.

10. A computer-readable storage medium, the storage medium comprising: a stored program; wherein the program, when run, controls a device in which the storage medium is located to perform the method of any one of claims 1 to 7.